2012-1-17 - Snort 2.9.2.1

[*] New Additions
 * Added new alerts for HTTP (undefined methods & HTTP 0.9 simple requests).

[*] Improvements
 * Updates to Stream preprocessor in TCP session tracking to avoid requeuing 
   retransmitted data that was already flushed. Also varies tweaks for PAF flushing.

 * Updates to reputation preprocessor to handle shared memory switching. 

 * Updates to the SCADA preprocessors in handling PAF flushing and modbus request/response
   length checking. Also tweaks in alert for reserved DNP3 functions.  

 * Updates to flowbit groups to always use the group when some rules refer to a flow group 
   while others do not refer to a group for the same flowbit. 

 * Updates to GTP preprocessor to check invalid extension header length for GTPv1.
 
 * Updates to sfrt library in calculating memory allocated and support for IPv6. 

2011-12-14 - Snort 2.9.2
[*] New Additions
 * SCADA (DNP3 and Modbus) preprocessors. Added two new preprocessors
   to support writing rules for detecting attacks for control systems.
   New rule keywords are supported, and DNP3 leverages Stream5 PAF
   support for TCP reassembly.  See the Snort Manual, README.dnp3 and
   README.modbus for details of the configurations and new rule
   options.

 * GTP decoding and preprocessor.  Updated the Snort packet decoders
   and added a preprocessor to support detecting attacks over GTP (GPRS
   Tunneling Protocol).  Snort's GTP support handles multiple versions
   of GTP and has a rich configuration set.  See the Snort Manual and
   README.GTP for details.

 * Updates to the HTTP preprocessor to normalize HTTP responses that
   include javascript escaped data in the HTTP response body.  This
   expands Snort's coverage in detecting HTTP client-side attacks.
   See the Snort Manual and README.http_inspect for configuration
   details.

 * Added Protocol-Aware Flushing (PAF) support for FTP.

[*] Improvements
 * Updates to Stream preprocessor to be able to track and store
   "stream" data for non TCP/UDP flows.  Also improvements to handle
   when memory associated with a blocked stream is released and usable
   for other connections.

 * Updates to dce_stub_data to make it act the same as file_data
   and pkt_data rule option keywords in how it interacts with
   subsequent content/pcre/etc rule options.

 * Updates to how Snort handles and processes signals received
   from the OS.

 * Enabled logging of normalized JavaScript to unified2 without the
   use of the --enable-sourcefire configuration option.

 * Improved handling of gaps and overlaps for "first" and "vista"
   policies in Stream5.

 * Added support for signal handler customization. At compile-time,
   Snort can be customized to use different signal numbers.
   This allows problems with overlapping signals to be fixed on a
   per-platform basis, which is especially helpful for the BSDs.
   See the Snort Manual for more details.

 * Perfmonitor's output files ("now" files) are now created after
   Snort drops privileges. Output files will now be owned by the
   user and group specified with "-u" and "-g" at the command line.
